Custom claims in access token with auth0-spa-js

Welcome to the Auth0 community, @n.selikoff!

The access token is meant to be sent to an API/backend, and not to be decoded by the SPA (frontend). The SPA should treat it as an opaque string. This is why the SDK does not decode the access token or provide a method to access the contents.

The ID token can be used in the SPA though. As you’ve already figured out, getIdTokenClaims() method can be used to get the claims.

1 Like